RegExp Password Generator: Client-Side Passwords With Real Regex Constraints

⬅️ Back to Tools

🛠️ RegExp Password Generator

What it isBrowser password generator driven by regex constraints
PlatformAny modern web browser
PriceFree, open source (MIT)
LinkLive demo · GitHub

Most password sites give you checkboxes: length 16, need a digit, need a symbol. Corporate policies are messier. They arrive as regex in an IT wiki, or as three overlapping rules that a checkbox UI cannot express. Niklas Gruhn’s RegExp Password Generator takes those rules literally: one JavaScript regex per line, generate five passwords that match all of them at once. It runs in your browser. Nothing is uploaded.

The UI looks vibe-coded. Rounded card, soft gray page, big Generate button. Fine. The interesting part is underneath: @gruhn/regex-utils, a hand-written TypeScript library for regex intersection, complement, equivalence, and sampling. The demo is a thin shell over real automata work.

  1. Constraints are the product. Paste policies as regex, one per line. The default deep link is already a solid starter: exactly 16 printable ASCII chars (^[\x21-\x7E]{16}$), plus at least one upper, one lower, and one digit. Hit Generate and you get five candidates that satisfy the whole set.

  2. Privacy is structural, not a marketing badge. Generation happens client-side. Your candidate passwords never need to leave the tab. That is the correct default for a tool whose output is a secret. Compare that to random “password strength” sites that POST your string to a server for scoring.

  3. The library is why this is not “reject until match” glue. @gruhn/regex-utils exposes set-style ops (.and, .not, .without), predicates (.isEquivalent, .isSubsetOf, .isEmpty), and generators (.sample, .enumerate). The password page intersects your constraint lines, then samples. You can use the same package from npm for test-data generation and regex refactor checks, not only passwords.

  4. Example patterns from the page cover the usual policy language: length bands (^.{16,32}$), printable ASCII only, required digit / upper / lower, required specials like [-_!@#$%^&*]. Stack them. The intersection is the actual password language.

  5. Honest limits. Not every JavaScript regex feature is supported (no word boundaries, no Unicode property escapes, no backreferences; anchors and lookarounds have caveats). Unsupported syntax should throw rather than silently lie. Also: a pretty SPA is not a threat model. Offline clone the static page or run the library locally if you want stronger assurance than “someone else’s GitHub Pages.” And regex policy can still be stupid. Matching a regex does not mean the password is high entropy if your pattern is tiny.

  6. Who should skip it. If you only ever need “16 random characters from a fixed alphabet,” your password manager’s built-in generator is enough. This tool earns a bookmark when policy is regex-shaped, when you are generating fixtures for auth tests, or when you refuse to type a password into a cloud toy.

Install & first run

No install for the demo:

  1. Open the password generator
  2. Edit the constraint textarea (one regex per line)
  3. Click Generate Passwords for five matches
  4. Copy one into your password manager; do not leave secrets sitting in a browser history screenshot

For code and custom tooling:

npm install @gruhn/regex-utils
import { RB } from "@gruhn/regex-utils";

const policy = RB(/^[\x21-\x7E]{16}$/)
  .and(/[A-Z]/)
  .and(/[a-z]/)
  .and(/[0-9]/);

for (const pwd of policy.sample().take(5)) {
  console.log(pwd);
}

There is also an equivalence checker demo if you are refactoring a hairy pattern and want counterexamples, not vibes.

Worth your time if: you need passwords (or test strings) that obey real regex policy, and you want that sampling local.

Related TMFNK Content

Crepi il lupo! 🐺